On-Chain Data Breaks Down the Initial Flow in the Major Binance Case: Where Did the $240M Laundered by Hackers Go?
Author: David, TechFlow
Two days after the $600 million Binance theft case, the initial on-chain trail of fund transfers has gradually become clear.
Currently, the over $3 billion in large-scale Bitcoin and Ethereum assets held by the hackers remain largely dormant; after stablecoin issuers froze approximately $2.7 billion, funds on the TRON chain became the primary laundering channel during the first 48 hours.
According to the comprehensive tracking by on-chain analyst @somaxbt, approximately $628 million was drained from the TRON chain (including $612 million USDT and $46.4 million TRX). On the first day of the incident, Tether froze 378 million USDT.
To avoid further contract-level freezes, the hackers consolidated the remaining unintercepted assets worth approximately $249 million into native TRX tokens and laundered around $242 million through cross-chain bridges within two days.
In-depth analysis of the data reveals that this $240 million in cross-chain transfers was primarily completed through four underlying channels, each demonstrating distinct allocation strategies and automation characteristics:
THORChain, Largest Outflow Channel
The hackers deposited 185 million TRX and 3.83 million USDT across 2,697 transactions.
After crossing chains, the funds were exchanged for 17,000 ETH and distributed across 170 Ethereum addresses, while also being converted into 53.25 BTC and spread across 20 Bitcoin addresses.
Relay Protocol, Anomalous Increment Channel
This channel handled 37.64 million USDT and 39.28 million TRX (totaling 735 deposits). In past incidents involving similar hacker groups, Relay rarely appeared as a core channel, but this time it became the second-largest outflow path on the TRON network.
Chainflip, High-Frequency Retry Characteristics
As the third-largest channel, this path involved the most complex on-chain operations.
The hackers pushed 49.47 million USDT through 571 deposits, encountering numerous failed exchanges. On-chain records show that failed refunds were automatically aggregated into new TRON wallets by the system, then re-submitted to the protocol for repeated retries, demonstrating a clear script execution logic.
Symbiosis, Small-Amount Fan-Out Strategy
The hackers abandoned large transfers on this channel, opting instead for a fragmented strategy.
Around 49.71 million TRX was deposited through 1,367 small transactions. After crossing chains, the funds were converted into 6,846 ETH and widely fanned out across 402 new Ethereum addresses.
Currently, the historical mission of TRON as an initial "money laundering transit hub" has basically ended. The massive number of deployed intermediary wallets have been physically emptied, leaving only about $7.5 million in residual value.
The closure of the TRON pathway means that this $240 million has been successfully broken down into smaller parts, completely missing the time window for single-chain interception.
The problem is, this is only a fraction of the hackers' total funds. They have used over $200 million to demonstrate their possession of an extremely mature, resilient, and fully automated cross-chain money laundering pipeline.
Meanwhile, they still hold over $3 billion in main assets currently at a standstill. When this batch of funds truly awakens and initiates mixing, existing tracking and interception mechanisms, along with market conditions, will face a genuine stress test.